ad93e037fa69cb66bd757866fd38ed0eab0db89541b4739c302aec7e797f5ec4 | Triage

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
12/02/2023, 16:50

Sharing

Report Analysis Logs

General

Target

32bit/Plugins/SubstanceArchive.dll
Size

18KB
MD5

e024742aca8e2a335aa8e36b238436e6
SHA1

76ab230957ea1ace4d674cc09e3928b81d773c16
SHA256

8db4ed2a072f907242b6c0f4c01698577692f587d3249f59eefb67de367e9f11
SHA512

214bdb2532c2c4114b713df1283ab451e50481d5a65850037d2fbfaeccc8e130b0b74d1c5b84ac747102c272c5fe4da194db155775a67c85b5bfbf54864cf097
SSDEEP

384:G1lyBq/ZnvsqkplObalUQcAfl9qOlghRJQKOZXOPVxP6:0ZvUtlY2AOl0LOZXOdxP6

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 4876	1232	rundll32.exe	79
PID 1232 wrote to memory of 4876	1232	rundll32.exe	79
PID 1232 wrote to memory of 4876	1232	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\32bit\Plugins\SubstanceArchive.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\32bit\Plugins\SubstanceArchive.dll,#1
  2⤵
  PID:4876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads